WHAT THE TOOLCHAIN RUNS ON
Supply chain
Most cyber tools are built on the same handful of open-source packages, so one bad release can ripple across the market. This page shows where those shared dependencies are, which tools lean on each, and which are running versions with exploited or unpatched vulnerabilities.
Known vulnerabilities in what the toolchain ships
Checked against the versions each tool actually builds with, not the version ranges it declares. Known-exploited means CISA lists the CVE as exploited in the wild. Exploit probability is FIRST's EPSS score, the chance of exploitation in the next 30 days. Checked 2026-10-07.
Highest risk right now
New in the last 30 days
If these broke
3 packages reach half the toolchain. 13 reach 80%.
Each bar is the next package that reaches the most tools not already counted. The line is the running total, out of the 380 tools that share any dependency. It takes 55 packages to reach every one. Click a bar to see its tools below.
- pypi
- go
- npm
- cargo
- maven
- tools reached so far
We count direct dependencies only, as each project declares them in its own manifests. Transitive dependencies aren't included, and each tool's SBOM reports those separately. Counting is by tool, so a monorepo that lists the same package in forty manifests counts once. We never merge ecosystems, because a PyPI package and a same-named npm package are different projects and get separate rows.
Why 197 tools are missing. 188 don't declare a manifest we can read. Most are C, C++, and shell projects that resolve dependencies through the build system or the distribution instead of a lockfile, so their absence is a limit of how we measure and doesn't mean they depend on nothing. The other 9 do declare dependencies, but each one is unique to that tool in our set, which tells you something about the tool.
Search for a tool to see its shared dependencies. Clear the search to return to the market view. The overview and package counts describe the whole market.
Built from the same artifacts as the per-tool pages. How this is measured →